+ Stuart, the author of BBSR From: boot-architecture <[email protected]> on behalf of AKASHI Takahiro <[email protected]> Date: Monday, February 15, 2021 at 4:19 PM To: Grant Likely <[email protected]> Cc: Heinrich Schuchardt <[email protected]>, [email protected] <[email protected]>, nd <[email protected]> Subject: Re: [EBBR PATCH 3/3] Require EFI_UPDATE_CAPSULE Hi Grant,
# apart from capsule update/EBBR, On Mon, Feb 15, 2021 at 05:28:32PM +0000, Grant Likely wrote: > > > On 12/02/2021 21:50, Heinrich Schuchardt wrote: > > On 2/12/21 7:59 PM, Grant Likely wrote: > > > EFI_UPDATE_CAPSULE is the industry standard method for applying firmware > > > updates. Make it a requirement in EBBR so that fwupd, Windows Update, > > > and any other generic firmware update service can support EBBR platforms. > > > > > > This is made required because the ability to update firmware is a > > > critical part of building secure platforms. > > > > > > Fixes: #69 > > > Signed-off-by: Grant Likely <[email protected]> > > > --- > > > source/chapter2-uefi.rst | 29 ++++++++++++++++++++++++++++- > > > 1 file changed, 28 insertions(+), 1 deletion(-) > > > > > > diff --git a/source/chapter2-uefi.rst b/source/chapter2-uefi.rst > > > index 3d48c99..4e8a24d 100644 > > > --- a/source/chapter2-uefi.rst > > > +++ b/source/chapter2-uefi.rst > > > @@ -352,7 +352,7 @@ are required to be implemented during boot > > > services and runtime services. > > > - Required > > > - Optional > > > * - `EFI_UPDATE_CAPSULE` > > > > As you have secure firmware in mind, shouldn't we explicitly require > > signature verification of capsules? > > Yes, but not yet. All the security requirements need to come in at the same > time so that it makes sense, and it may be that we adopt BBSR as the > security standard instead of adding it into EBBR. looking at BBSR (v1.0a, downloaded from Arm site), it mentions EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS as one of required attributes for authenticated variables. But it is already marked as deprecated in UEFI spec, and I didn't implement it on U-Boot UEFI. Has that statement in BBSR already been modified/fixed? -Takahiro Akashi > g. > > > > > Best regards > > > > Heinrich > > > > > - - Optional > > > + - Required for in-band update > > > - Optional > > > * - `EFI_QUERY_CAPSULE_CAPABILITIES` > > > - Optional > > > @@ -435,6 +435,25 @@ Even when SetVariable() is not supported during > > > runtime services, firmware > > > should cache variable names and values in EfiRuntimeServicesData > > > memory so > > > that GetVariable() and GetNextVeriableName() can behave as specified. > > > > > > +Firmware Update > > > +--------------- > > > + > > > +Being able to update firmware to address security issues is a key > > > feature of secure platforms. > > > +EBBR platforms are required to implement either an in-band or an > > > out-of-band firmware update mechanism. > > > + > > > +If firmware update is performed in-band (firmware on the > > > application processor updates itself), > > > +then the firmware shall implement EFI_UPDATE_CAPSULE and accept > > > updates in the > > > +"Firmware Management Protocol Data Capsule Structure" format as > > > described in [UEFI]_ § 23.3, > > > +"Delivering Capsules Containing Updates to Firmware Management > > > Protocol. [#FMPNote]_ > > > +Firmware is also required to provide an EFI System Resource Table > > > (ESRT). [UEFI]_ § 23.4 > > > +Every firmware image that is updated in-band must be described in > > > the ESRT. > > > + > > > +If firmware update is performed out-of-band (e.g., by an > > > independent Board Management Controller, > > > +or firmware is provided by a hypervisor), then the platform is not > > > required to implement EFI_UPDATE_CAPSULE. > > > + > > > +EFI_UPDATE_CAPSULE is only required before ExitBootServices() is called. > > > + > > > + > > > .. [#OPTEESupplicant] It is worth noting that OP-TEE has a > > > similar problem > > > regarding secure storage. > > > OP-TEE's chosen solution is to rely on an OS supplicant > > > agent to perform > > > @@ -445,3 +464,11 @@ that GetVariable() and GetNextVeriableName() > > > can behave as specified. > > > during runtime services. > > > > > > https://optee.readthedocs.io/en/latest/architecture/secure_storage.html > > > + > > > +.. [#FMPNote] The `EFI_UPDATE_CAPSULE` implementation is expected > > > to be suitable > > > + for use by generic firmware update services like fwupd and > > > Windows Update. > > > + Both fwupd and Windows Update read the ESRT table to determine > > > what firmware > > > + can be updated, and use an EFI helper application to call > > > `EFI_UPDATE_CAPSULE` > > > + before ExitBootServices() is called. > > > + > > > + https://fwupd.org/ > > > > > > _______________________________________________ > boot-architecture mailing list > [email protected] > https://lists.linaro.org/mailman/listinfo/boot-architecture _______________________________________________ boot-architecture mailing list [email protected] https://lists.linaro.org/mailman/listinfo/boot-architecture IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. _______________________________________________ boot-architecture mailing list [email protected] https://lists.linaro.org/mailman/listinfo/boot-architecture
